This is fallout from converting from the custom list implementation to
GList. In xml_stack_pop we were using free() instead of g_list_free_1 to
free a list node but also we were leaving the prev member of the new top
in an inconsistent (non-NULL) state which was confusing the GList
implementation resulting in a crash. We now use g_list_delete_link to
remove the top of the list.